Am Mo, den 30.01.2006 schrieb Adriano Frare um 19:17:
I use Centos 4.2 with all service pack installed. I verified traffic on link WEB and I see port TCP 80 with many traffic.
I accessed lod /var/log/httpd/access_log and show below.
ca.com/members/index.php HTTP/1.0" 401 - "http://members.sapphicerotica.com/members/index.php" "Mozilla/5.0 ( compatible; MSIE 5.01; Windows XP; NetCaptor )" 68.119.110.138 - - [30/Jan/2006:15:08:08 -0200] "GET http://211.115.101.253/config/login?.done=http://smallbusiness.yahoo.com/ser... HTTP/1.0" 200 9794 "-" "-" 68.119.110.138 - - [30/Jan/2006:15:08:10 -0200] "GET http://211.115.101.253/config/login?.done=http://smallbusiness.yahoo.com/ser... HTTP/1.0" 200 9786 "-" "-" 80.144.212.33 - - [30/Jan/2006:15:08:09 -0200] "GET http://www.995members.com/members/ HTTP/1.0" 401 472 "http://www.995members.com" "Mozilla/5.0 ( Windows; U; Windows NT5.1; DigiExt )" 68.119.110.138 - - [30/Jan/2006:15:08:10 -0200] "GET http://211.115.101.253/config/login?.done=http://smallbusiness.yahoo.com/ser... HTTP/1.0" 200 9786 "-" "-" 68.119.110.138 - - [30/Jan/2006:15:08:12 -0200] "GET http://211.115.101.253/config/login?.done=http://smallbusiness.yahoo.com/ser... HTTP/1.0" 200 9786 "-" "-" 68.119.110.138 - - [30/Jan/2006:15:08:13 -0200] "GET http://211.115.101.253/config/login?.done=http://smallbusiness.yahoo.com/ser... HTTP/1.0" 200 9786 "-" "-" 68.119.110.138 - - [30/Jan/2006:15:08:14 -0200] "GET http://211.115.101.253/config/login?.done=http://smallbusiness.yahoo.com/ser... HTTP/1.0" 200 9786 "-" "-" 68.119.110.138 - - [30/Jan/2006:15:08:16 -0200] "GET http://216.109.126.252/config/login?.done=http://smallbusiness.yahoo.com/ser... HTTP/1.0" 999 4445 "-" "-" 68.119.110.138 - - [30/Jan/2006:15:08:17 -0200] "GET http://216.109.126.252/config/login?.done=http://smallbusiness.yahoo.com/ser... HTTP/1.0" 999 4445 "-" "-" 68.119.110.138 - - [30/Jan/2006:15:08:18 -0200] "GET http://216.109.126.252/config/login?.done=http://smallbusiness.yahoo.com/ser... HTTP/1.0" 999 4445 "-" "-" 82.39.175.52 - - [30/Jan/2006:15:08:35 -0200] "GET http://l1.login.dcn.yahoo.com/config/login?.redir_from=PROFILES?&.tries=... HTTP/1.0" 502 961 "-" "-" 80.144.212.33 - - [30/Jan/2006:15:08:43 -0200] "GET http://www.995members.com/members/ HTTP/1.0" 401 472 "http://www.995members.com" "Mozilla/5.0 ( Windows; U; Windows NT5.1; DigiExt )" 12.206.3.132 - - [30/Jan/2006:15:08:46 -0200] "GET http://us.a1.yimg.com/login.bjs.yahoo.com/config/login?login=big_g_&pass... HTTP/1.0" 200 4440 "http://www.yahoo.com/" "-" 84.109.4.111 - - [30/Jan/2006:15:08:51 -0200] "CONNECT login.icq.com:443 HTTP/1.0" 200 - "-" "-"
I guess that hacker is using my SERVR APACHE to PROXY.
Correct. The log provided show that. Looks like your host is already known to a crowd of misusers or the one who found you is already using several hosts to do his actions (see the originating IPs).
Please, I need help urgent.
What do you expect? We don't know your Apache setup. Go through your httpd.conf and included configuration files and deactivate proxying - or at least make it secure if you need it for specific tasks.
I stoped service HTTPD because it.
Good.
Adriano
Alexander